Nmap Cheat Sheet

Nmap is the tool you reach for first on almost every engagement — before anything else happens, you need to know what's alive and what's listening.

Red Team / Offensive Use

Nmap's job in an engagement is narrow but critical: host discovery and service/version enumeration that everything else builds on. A missed open port or misidentified service version early on can mean missing the actual way in. It's also useful mid-engagement for pivoting — running a scan from a compromised host to map an internal network you didn't have visibility into before.

Established Cheatsheet

SANS Pen Test Cheat Sheet: Nmap — the standard reference, covers target/port specification, scan types, and NSE scripting in depth.

PWNMI's Top 6 Use Cases

• nmap -sV -sC -p- -T4 <ip> — full-port version + default-script scan, the default starting point on almost every target
• nmap -sn <subnet>/24 — host discovery only, no port scan; the right first move against an unfamiliar network
• nmap -sU --top-ports 20 <ip> — quick UDP check; UDP scans are slow, so start with the ports that actually matter
• nmap --script vuln <ip> — runs NSE's vulnerability-detection scripts against discovered services; a fast way to surface known CVEs
• nmap -Pn <ip> — skip host discovery (treat the host as up); necessary when ICMP is blocked and a normal scan would report the host as down
• nmap -oA scan_results <ip> — save output in all formats; always do this, you'll want to grep it later

Next step

New to Nmap entirely? Start with the full Nmap fundamentals guide before using this as a quick reference.